EUVD-2026-42803
GHSA-7pc9-597v-3fmf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level auth (PR:L) required; scope changes to other users' browsers (S:C); no availability impact; consistent with stored XSS pattern.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The affiliate-toolkit - WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is a bypass to CVE-2024-10227.
AnalysisAI
Stored Cross-Site Scripting in the affiliate-toolkit WP Affiliate Plugin with Amazon (versions through 3.7.0) allows authenticated contributors to inject persistent malicious scripts via the 'atkp_product' shortcode due to unsanitized user-supplied attributes. This represents a bypass of the previously patched CVE-2024-10227, indicating the prior fix was incomplete. Any WordPress user - including administrators - who loads a page containing the injected shortcode will execute the attacker's script in their browser, enabling session theft, credential harvesting, or unauthorized admin actions. No public exploit or CISA KEV listing is identified at time of analysis.
Technical ContextAI
The affected component is the 'atkp_product' WordPress shortcode implemented in the affiliate-toolkit-starter plugin, with the vulnerable output logic traceable to includes/atkp_output.php (line 299 per the referenced browser link). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied shortcode attributes are passed through to rendered HTML without adequate escaping or sanitization, allowing script injection that persists in the database. The scope-changed CVSS vector (S:C) reflects WordPress's trust boundary model: a contributor injects content into a post, but the impact crosses into the security context of other authenticated users (e.g., admins) who render that post. The fact that this is a bypass of CVE-2024-10227 confirms that a prior sanitization fix in the same shortcode was either incomplete or circumventable through alternate attribute paths.
RemediationAI
An upstream code fix is available via WordPress plugin repository changeset 3227483 (https://plugins.trac.wordpress.org/changeset/3227483/), which addresses the sanitization deficiency in atkp_output.php; however, a specific patched plugin version number is not independently confirmed from the available data - administrators should update to the latest available version in the WordPress plugin directory and verify the changelog for a fix referencing CVE-2026-15296 or CVE-2024-10227 bypass. As an interim workaround, restrict contributor-level role assignment to only fully trusted users, and disable the ability for contributors to publish posts containing the 'atkp_product' shortcode by using a plugin such as Prevent Specific Roles From Using Shortcodes. A Content Security Policy (CSP) header restricting inline script execution can reduce the impact of successful injection but will not prevent the vulnerability. Note: CSP deployment may break legitimate JavaScript on the site and requires testing.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today